Upgrade `semver` to fix vulnerability

[brianlenz]

There is a vulnerability with semver < 7.5.2:

GHSA-c2qf-rxjj-qqgw

The solution is to upgrade semver to 7.5.3 which includes a patch to fix the vulnerability.

[ljharb]

Like most CVEs, it's a false positive. We're not using new Range nor are we doing anything that wouldn't be a self-attack (ie, not an attack).

We can't ever bump the semver version because v7 drops support for engines we support, so unless the fix is backported to v6, it'll just have to remain a false positive.

Duplicate of #2803. Duplicate of #2804. Duplicate of #2805.

[brianlenz]

@ljharb apologies for the duplicate 🙈 And the explanation is sensible...appreciate it 🙏